Ajax, IE, and ActiveX

I want to avoid causing IE security warnings

[MatthewHSE]

I haven't worked with Ajax much, but from what I've seen so far, one of the first things you have to do is split your script - one part for non-IE browsers, and the other part for IE, which then uses ActiveX to achieve the desired functionality. Here's part of an example I found online:

var http = null;
if(window.XMLHttpRequest)
http = new XMLHttpRequest();
else if (window.ActiveXObject)
http = new ActiveXObject("Microsoft.XMLHTTP");

The problem is that I can't test how and when IE will give an ActiveX warning. I've heard that things got a lot stricter with WinXP SP2, and IE7 supposedly goes even further. But I don't have access to either of these for testing.

Any recommendations, experiences, and "best practice" tips will be appreciated.

Thanks,

Matthew

[DrDoc]

IE always give security warnings when running locally.

[MatthewHSE]

Locally - that means when it's not getting the page from a webserver, right? In that case I'm okay so far, since this won't be available locally.

What kind of warnings, if any, does IE give for ActiveX like the example above when not running locally?

[DrDoc]

I'm afraid I can't help you on that one. It also depends on the individual IE settings though. Some have it set to warn whenever there's ActiveX content. I don't think that's the default setting though ... but perhaps someone can shed some light on that.

The best thing to do would be to test it live with a fresh IE installation.

And, yes ... "locally" means when you run it on your machine, and did not get it from a webserver.

[MatthewHSE]

Thanks - I'll have a new IE installation sometime within the next week and I'll give it a try then. The problem is that it will be IE on W2K, and I'm not sure if there will be any differences between that and XP. If anyone has specific experience with this issue, I'd love to hear about it. I don't see how this can be a big problem overall, given the number of sites using this technique. But I'd rather know for sure before I roll it out on my site! ;)

[DrDoc]

There are not too many differences between W2K and XP (assuming you're running the same version of IE). There are, however, several big differences between W2K/XP and XP SP2.

[Bernard Marx]

Locally - that means when it's not getting the page from a webserver, right? In that case I'm okay so far, since this won't be available locally.

Hmmm. No, that's when the page instatiating the object is running within the local file system, rather than a webserver. So, with XP SP2, it seems you need to be running a server to test the script.

1) AFAIK, XMLHTTPRequests can't actually call pages from within the file system.

2) As Doc says, there are big differences. On my Win 2000, I can instantiate an XMLHTTP request in IE of a local file and make requests for resources from remote servers. In other words, I get cross-domain access too.

[execute]

you could use try { //test ActiveXObject } catch(e) { // try again! }

But like the others said there is no way to check for warnings i dont know what you are talking about.